71f425194805aaeb80b56f160cef9d55d7b21821807d3e1ee7137b33a03557ca

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 19:19

Target

c6ab8ac626a67379e95efd381058b113.exe
Size

72KB
MD5

c6ab8ac626a67379e95efd381058b113
SHA1

43a5bc7f2394e35d33da4d75bc676977fb499be6
SHA256

71f425194805aaeb80b56f160cef9d55d7b21821807d3e1ee7137b33a03557ca
SHA512

dc195f14dc86bfd875571e4e95a7128c15d6fc38bd26480ca6eabaf8f7d6c0889745f48bf18586e0cecd77182c84eb470ea0133eb57a091a44e38941fec2793c
SSDEEP

1536:sRzDTwCfd7JTKzo0CGqiCaFWwwhk0hj60oKNPc68BvXsGNgwpOmiaRWDR:EbfdJTKzo0CGJ+hksxPNdW/sGNgwpOmw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1660	2384	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1660	2384	c6ab8ac626a67379e95efd381058b113.exe	28
PID 2384 wrote to memory of 1660	2384	c6ab8ac626a67379e95efd381058b113.exe	28
PID 2384 wrote to memory of 1660	2384	c6ab8ac626a67379e95efd381058b113.exe	28
PID 2384 wrote to memory of 1660	2384	c6ab8ac626a67379e95efd381058b113.exe	28

C:\Users\Admin\AppData\Local\Temp\c6ab8ac626a67379e95efd381058b113.exe
"C:\Users\Admin\AppData\Local\Temp\c6ab8ac626a67379e95efd381058b113.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 44
  2⤵
  - Program crash
  PID:1660

memory/2384-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download